CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected products: Apache Software Foundation Apache Log4j2
CWE: CWE-502 Deserialization of Untrusted Data, CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK secondary impact: T1486, T1496, T1505.003, T1608.001
ATT&CK techniques (all): T1190, T1486, T1496, T1505.003, T1608.001
CVE-2021-21972: 
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected products: VMware vCenter Server, VMware Cloud Foundation
CWE: Remote code execution vulnerability, CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2012-6467: 
Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site, as exploited in the wild in November 2012.

ATT&CK techniques (all): T1203, T1566
CVE-2010-1423: 
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.

ATT&CK techniques (all): T1189, T1203
CVE-2012-2539: 
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."

CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1189
CVE-2019-1665: Cisco Hyperflex Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Versions prior to 3.5(1a) are affected.

Affected products: Cisco Cisco HyperFlex HX-Series
CWE: CWE-79
CVSS: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1557
ATT&CK techniques (all): T1059.007, T1204.001, T1557
CVE-2017-9805: 
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Affected products: Apache Software Foundation Apache Struts
CWE: RCE, CWE-502 Deserialization of Untrusted Data
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2019-1035: Microsoft Word Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.
To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Word software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.
The security update addresses the vulnerability by correcting how Microsoft Word handles files in memory.

Affected products: Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft Office 2019, Microsoft Microsoft Office 2019 for Mac, Microsoft Office 365 ProPlus, Microsoft Microsoft Office Online Server, Microsoft Microsoft Office 2016 for Mac
CWE: Remote Code Execution
ATT&CK exploitation technique(s): T1203, T1204.002
ATT&CK primary impact: T1499.004, T1574
ATT&CK techniques (all): T1203, T1204.002, T1499.004, T1574
CVE-2019-11869: 
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.

ATT&CK techniques (all): T1499.004
CVE-2015-1769: 
Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability."

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1068, T1091
CVE-2018-7513: 
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a stack-based buffer overflow.

Affected products: ICS-CERT Omron CX-Supervisor
CWE: CWE-121 STACK-BASED BUFFER OVERFLOW CWE-121
ATT&CK techniques (all): T1203
CVE-2017-18362: 
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1059, T1190
CVE-2019-1879: Cisco Integrated Management Controller CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploit this vulnerability by authenticating with the administrator password via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.

Affected products: Cisco Cisco Unified Computing System (Management Software)
CWE: CWE-78
CVSS: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1068, T1078
CVE-2020-11013: lookup Function Information Discolosure in Helm
Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0

Affected products: helm Helm
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
ATT&CK primary impact: T1190
ATT&CK techniques (all): T1190
CVE-2020-0671: 
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0668, CVE-2020-0669, CVE-2020-0670, CVE-2020-0672.

Affected products: Microsoft Windows, Microsoft Windows Server, Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation), Microsoft Windows 10 Version 1909 for 32-bit Systems, Microsoft Windows 10 Version 1909 for x64-based Systems, Microsoft Windows 10 Version 1909 for ARM64-based Systems, Microsoft Windows Server, version 1909 (Server Core installation)
CWE: Elevation of Privilege
ATT&CK primary impact: T1499.004, T1574
ATT&CK secondary impact: T1005, T1136, T1485, T1565
ATT&CK techniques (all): T1005, T1136, T1485, T1499.004, T1565, T1574
CVE-2020-6986: 
In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result.

Affected products: Omron PLC CJ Series
CWE: CWE-400 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ATT&CK primary impact: T1499
ATT&CK techniques (all): T1499
CVE-2015-6480: 
The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.

ATT&CK techniques (all): T1059, T1190
CVE-2024-4577: Argument Injection in PHP-CGI
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Affected products: PHP Group PHP, php_group php
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1003, T1003.001, T1033, T1041, T1053, T1068, T1071.001, T1112, T1543, T1570
ATT&CK techniques (all): T1003, T1003.001, T1033, T1041, T1053, T1059, T1068, T1071.001, T1112, T1190, T1543, T1570
CVE-2020-11668: 
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.

ATT&CK techniques (all): T1499.004
CVE-2019-1781: Cisco FXOS and NX-OS Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.

Affected products: Cisco Cisco NX-OS Software
CWE: CWE-77
CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1608
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1078, T1608
CVE-2025-31200: 
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

Affected products: Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS
CWE: Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1., CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1203
ATT&CK primary impact: T1105
ATT&CK secondary impact: T1001, T1059, T1106, T1557, T1685
ATT&CK techniques (all): T1001, T1059, T1105, T1106, T1203, T1557, T1685
CVE-2018-8431: 
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8428.

Affected products: Microsoft Microsoft SharePoint Server, Microsoft Microsoft SharePoint
CWE: Information Disclosure
ATT&CK primary impact: T1190
ATT&CK secondary impact: T1565
ATT&CK techniques (all): T1190, T1565
CVE-2022-22954: 
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Affected products: VMware Workspace ONE Access and Identity Manager
CWE: Remote code execution, CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1221
ATT&CK primary impact: T1505.003
ATT&CK techniques (all): T1221, T1505.003
CVE-2025-54309: 
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Affected products: CrushFTP CrushFTP
CWE: CWE-420 Unprotected Alternate Channel
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1567
ATT&CK secondary impact: T1021
ATT&CK techniques (all): T1021, T1068, T1567
CVE-2020-8196: 
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Affected products: Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
CWE: CWE-284 Improper Access Control - Generic (CWE-284)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
ATT&CK exploitation technique(s): T1056
ATT&CK primary impact: T1082
ATT&CK secondary impact: T1005
ATT&CK techniques (all): T1005, T1056, T1082
CVE-2020-3387: Cisco SD-WAN vManage Software Remote Code Execution Vulnerability
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerability by sending a crafted response to the Cisco SD-WAN vManage Software. A successful exploit could allow the attacker to access the software and execute commands they should not be authorized to execute.

Affected products: Cisco Cisco SD-WAN vManage
CWE: CWE-20
CVSS: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133, T1190
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1133, T1190
CVE-2020-12008: 
Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI.

Affected products: Baxter ExactaMix EM 2400 & EM 1200
CWE: CWE-319 CLEARTEXT TRANSMISSION OF SENSITIVE DATA CWE-319
ATT&CK primary impact: T1552
ATT&CK techniques (all): T1552
CVE-2023-20109: 
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.
 This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

Affected products: Cisco IOS, Cisco Cisco IOS XE Software
CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059, T1499
ATT&CK techniques (all): T1059, T1078, T1499
CVE-2020-8467: 
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.

Affected products: Trend Micro Trend Micro OfficeScan, Trend Micro Apex One
CWE: RCE, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1068
CVE-2013-0422: 
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114.  CVE-2013-0422 covers both the JMX/MBean and Reflection API issues.  NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks.  NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11.  If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

CWE: CWE-284 Improper Access Control
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1189, T1203
CVE-2018-9488: 
In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, with System privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-110107376.

Affected products: Google Inc. Android
CWE: Elevation of privilege
ATT&CK techniques (all): T1068
CVE-2024-12686: Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

Affected products: BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1059, T1068
ATT&CK techniques (all): T1059, T1068